ROX-16426 / ROX-14418: Get ENP up and running (#24)

.github/workflows/push-networks.yaml

@@ -1,13 +1,41 @@
-name: Build external-network-pusher
+name: Update external networks
 
 on:
+  pull_request:
+    types:
+    - opened
+    - reopened
+    - synchronize
   schedule:
-    - cron: 30 19 * * * # Run this every day at 19:30 UTC
+    - cron: 30 10 * * * # Run this every day at 10:30 UTC
   workflow_dispatch:
+    inputs:
+      dry-run:
+        description: Execute Dry Run
+        required: false
+        default: true
+        type: boolean
 
 
 jobs:
-  build-and-upload:
+  save-current-networks:
+    name: Download and store currently published latest networks
+    if:  github.event_name == 'schedule' || (github.event.inputs.dry-run == 'false' && github.event_name == 'workflow_dispatch') # Can only be triggered by scheduled run or manual action with dry-run set to false
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Download and test latest networks 
+        run: ${GITHUB_WORKSPACE}/.github/workflows/scripts/download-current-networks.sh
+        shell: bash
+
+      - uses: actions/upload-artifact@v3
+        with:
+          name: current-latest-networks
+          path: /tmp/external-networks
+
+
+  build:
     name: Build external-network-pusher
     runs-on: ubuntu-latest
     steps:
@@ -44,12 +72,39 @@ jobs:
           name: bin
           path: .gobin
 
+  run-dry-run: # Dry run will run on PRs by default
+    runs-on: ubuntu-latest
+    needs: build
+    name: Dry-run external-network-pusher and simulate results
+    steps:
+      - uses: 'google-github-actions/auth@v1'
+        with:
+          credentials_json: '${{ secrets.GCP_NETWORKS_UPLOADER_SA }}'
+      - name: 'Set up Cloud SDK'
+        uses: 'google-github-actions/setup-gcloud@v0'
+
+      - name: Download executable
+        uses: actions/download-artifact@v3
+        with:
+          name: bin
+
+      - name: Set permissions to file
+        run:  chmod +x linux/network-crawler
+
+      - name: Dry run external-network-pusher
+        run:  linux/network-crawler --dry-run --bucket-name definitions.stackrox.io
 
   run-and-upload:
-    runs-on: ubuntu-latest
-    needs: build-and-upload
     name: Run external-network-pusher and upload results
+    if:  github.event_name == 'schedule' || (github.event.inputs.dry-run == 'false' && github.event_name == 'workflow_dispatch') # Can only be triggered by scheduled run or manual action with dry-run set to false
+    runs-on: ubuntu-latest
+    needs: [build, save-current-networks]
     steps:
+      - uses: 'google-github-actions/auth@v1'
+        with:
+          credentials_json: '${{ secrets.GCP_NETWORKS_UPLOADER_SA }}'
+      - name: 'Set up Cloud SDK'
+        uses: 'google-github-actions/setup-gcloud@v0'
 
       - name: Download executable
         uses: actions/download-artifact@v3
@@ -60,7 +115,30 @@ jobs:
         run:  chmod +x linux/network-crawler
 
       - name: Run external-network-pusher
-        run:  linux/network-crawler --dry-run --bucket-name 123
-        continue-on-error: false
+        run:  linux/network-crawler --bucket-name definitions.stackrox.io
+
+  notify:
+    name: Notify about failed run
+    if: failure()
+    needs: run-and-upload
+    runs-on: ubuntu-latest
+    env:
+      SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+    steps:
+      - name: Post to Slack channel team-acs-maple-interruptions
+        uses: slackapi/[email protected]
+        with:
+          channel-id: "C03SWCX9W0Z"
+          payload: >-
+            { "blocks": [
+
+            { "type": "section", "text": { "type": "mrkdwn", "text":
+            ":red-warning: Daily update of external networks for defintions.stackrox.io failed! :red-warning:\nRefer to the Workflow logs for more information."}},
 
+            { "type": "divider" },
 
+            { "type": "section", "text": { "type": "mrkdwn", "text":
+            ">
+            Repository: <${{github.server_url}}/${{github.repository}}|${{github.repository}}>\n>
+            Workflow: <${{github.server_url}}/${{github.repository}}/actions/runs/${{github.run_id}}|${{github.workflow}}>" }}
+            ]}

.github/workflows/scripts/download-current-networks.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+# Fetches the current latest networks before updating them through the external networks pusher
+
+set -euo pipefail
+
+mkdir -p /tmp/external-networks
+latest_prefix="$(wget -q https://definitions.stackrox.io/external-networks/latest_prefix -O -)"
+wget -O /tmp/external-networks/checksum "https://definitions.stackrox.io/${latest_prefix}/checksum"
+wget -O /tmp/external-networks/networks "https://definitions.stackrox.io/${latest_prefix}/networks"
+test -s /tmp/external-networks/checksum
+test -s /tmp/external-networks/networks